Claude Code GitHub Action: Prompt-Injection Credential Theft (Microsoft Disclosure)
Claude Code GitHub Action: Prompt-Injection Credential Theft (Microsoft Disclosure) is a high-severity prompt injection issue in Claude Code GitHub Action, a CI integration. Affected: <2.1.128. Fixed in 2.1.128.
Is Claude Code GitHub Action running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
claude-code-github-action-prompt-injection-credential-theft-microsoft- Severity
- high
- Attack type
- Prompt injection, Credential theft
- Component
- Claude Code GitHub Action · CI integration
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Microsoft Security disclosed a now-patched flaw in Anthropic's Claude Code GitHub Action: attackers hide prompt-injection instructions in GitHub issues, pull requests, or comments to manipulate the agent into reading files that hold CI/CD secrets (API keys, cloud credentials) and exfiltrating them. Reported via HackerOne on 2026-04-29 and patched in Claude Code 2.1.128 on 2026-05-05; publicly detailed 2026-06-06.
Affected versions
| Affected | Fixed in |
|---|---|
<2.1.128 | 2.1.128 |
Am I affected by this vulnerability?
You are affected if you run Claude Code GitHub Action <2.1.128. Versions 2.1.128 and later include the fix.
How do I fix it?
Upgrade Claude Code to 2.1.128 or later. Treat all untrusted GitHub content (issues, PRs, comments) as hostile input; scope CI/CD secrets to least privilege and keep them out of agent-readable files. Review GitHub Action run logs for anomalous file access since late April.